Recovering data from NTFS HD with lost partion table/info

I have a HD with a single NTFS partion which have lost the
partition table info because of corrupt sectors/blocks.

I have tried DIY DataRecovery iRecover and OnTrack EasyRecovery
to copy/recover the data to a new disk. With DIY DataRecovery
I can scan the disk to find the NTFS partion and start the
recovery but the progress bar stays on 0% all the time.
The program also says Filesystem type is: Not known so far
during that time, even it it earlier found the partion info
when scanning.

When using OnTrack EasyRecovery the program starts and displaying
the filenames/directory it finds and increases the block
count but after a couple of minutes it stops at the same block number
every time I run it (#3840) and the disk sound stops which was
was heard up till this block number. And it does not continue to
even if I wait a very long time.

Is there any possibly to copy the information over to a new
hard drive in any way, which ignore corrupt block, so I can
revover most of the files?

Advertisements

"Ken1" <> wrote in message
news:...
> I have a HD with a single NTFS partion which have lost the
> partition table info because of corrupt sectors/blocks.
>
....
>
> When using OnTrack EasyRecovery the program starts and displaying
> the filenames/directory it finds and increases the block
> count but after a couple of minutes it stops at the same block number
> every time I run it (#3840) and the disk sound stops which was
> was heard up till this block number. And it does not continue to
> even if I wait a very long time.

Advertisements

In article <>,
Eric Gisin <> wrote:
>Run your disk's diagnostics first, to see how damaged the disk is.
>
>"Ken1" <> wrote in message
>news:...
>> I have a HD with a single NTFS partion which have lost the
>> partition table info because of corrupt sectors/blocks.
>>
>...
>>
>> When using OnTrack EasyRecovery the program starts and displaying
>> the filenames/directory it finds and increases the block
>> count but after a couple of minutes it stops at the same block number
>> every time I run it (#3840) and the disk sound stops which was
>> was heard up till this block number. And it does not continue to
>> even if I wait a very long time.
>

Download and burn a Knoppix CD (www.linuxiso.org). Boot it.
It tries to mount all your NTFS/FAT32 partitions, by default.

If it does mount your disk you stand a chance of copying the files to
another disk if you put one in the system. Probably best if you
pre-format the disk (fat32. Linux can't write to NTFS, yet.) (you
have to screw around a little to mount the new disk as writable. Ask
in one of the Linux groups.)

"Ken1" <> wrote in message
news:...
> I have a HD with a single NTFS partion which have lost the
> partition table info because of corrupt sectors/blocks.
>
> I have tried DIY DataRecovery iRecover and OnTrack EasyRecovery
> to copy/recover the data to a new disk. With DIY DataRecovery
> I can scan the disk to find the NTFS partion and start the
> recovery but the progress bar stays on 0% all the time.
> The program also says Filesystem type is: Not known so far
> during that time, even it it earlier found the partion info
> when scanning.
>
> When using OnTrack EasyRecovery the program starts and displaying
> the filenames/directory it finds and increases the block
> count but after a couple of minutes it stops at the same block number
> every time I run it (#3840) and the disk sound stops which was
> was heard up till this block number. And it does not continue to
> even if I wait a very long time.
>
> Is there any possibly to copy the information over to a new
> hard drive in any way, which ignore corrupt block, so I can
> revover most of the files?
>
> /Kenneth

If it's already known there are bad blocks I'd clone the drive first to a
'known to be good' drive. If damage is indeed limited to the partition
tables (which I doubt), those can be rebuild on the new drive. Even if
partition tables can't be rebuild iRecover or EasyRecovery will probably
perform better.

Our DiskPatch program can used to clone disks that have bad sectors. I am
sure there are other as well, just make sure that they offer a mechanism to
deal with unreadable sectors.

On Sat, 21 Feb 2004 23:06:03 UTC, (Ken1) wrote:
> I have a HD with a single NTFS partion which have lost the
> partition table info because of corrupt sectors/blocks.

Is the 'corrupt sector' in the partitiontable itself, or in the NTFS
partition ?
>
> I have tried DIY DataRecovery iRecover and OnTrack EasyRecovery
> to copy/recover the data to a new disk. With DIY DataRecovery
> I can scan the disk to find the NTFS partion and start the
> recovery but the progress bar stays on 0% all the time.

Perhaps it stops at (or keeps retrying) the bad sector ...
> The program also says Filesystem type is: Not known so far
> during that time, even it it earlier found the partion info
> when scanning.
>
> When using OnTrack EasyRecovery

Does the disk use Ontrack disk-manager to use the full capacity ?
(meaning a special MBR is used, making recovery more difficult)
> the program starts and displaying
> the filenames/directory it finds and increases the block
> count but after a couple of minutes it stops at the same block number
> every time I run it (#3840) and the disk sound stops which was
> was heard up till this block number. And it does not continue to
> even if I wait a very long time.

Probably an area with bad-sectors ...

You can find bad-sectors using DFSee as well (see below), but if
the bad-sectors are the result of physical damage to the disk
(head crash) you should avoid reading and writing as much
as possibble since that might create MORE bad sectors.

Just try to read them just ONCE, to copy them to
a new undamaged disk ...
>
> Is there any possibly to copy the information over to a new
> hard drive in any way, which ignore corrupt block, so I can
> revover most of the files?

Yes, you can with my DFSee utility.

If you have a new disk available (of same or larger size) you can
instruct it to CLONE the old disk to the new one, and ignore any
bad-sectors while copying.

For a description of that procedure, read about it in item 51 of
DFSHOWTO.TXT that comes with the download, or read it here:

Note the description of the "-b:1" parameter, which will make the
CLONE
quite slow (many hours) but will result in the minimum number of
sectors
being skipped as bad-sectors.

Once you have a copy on a working disk, you can use the DFSUNFD
procedure to find tha partition layout, and then use some CREATE
commands to recreate that on the new disk.

If the NTFS partition itself is not damaged, this should bring back
all your data.

The DFSee download includes a DOS, Windows and OS2 version,
and the DOS version is probably the best one to use here, started
from a bootable DOS diskette. You can even download a self-extracting
image of such a bootable diskette including DFSDOS.EXE from:

Don't you worry, help is more affordable than you think! Especially
when you consider what your time is worth to you, and how much importance
you place on your valuable data.

My company specializes in computer forensic data recovery services and
data recovery software development. We develop and employ the latest
data recovery software on the market so we can often recover deleted
files pretty quickly! We serve individuals, small businesses, and
corporations worldwide.

In your case, it is very likely that we could recover most, if not
all, of your data. Because you know the name of the folder or files that
were deleted, it would be pretty quick for us to do. We can also search
for specific filenames you need recovered and even recover partially
overwritten data (e.g., an important MS Word document).

Once you delete your data and empty the recycle bin, your data ends up
in unallocated space. So essentially, you can try using third party
freeby software and cross your fingers, or you can leave it up to the
experts.

By the way, we serve both individuals and corporations. Our rates are
very reasonable and you only pay if we recover your data. No data, no
charge. What we would need is your hard drive shipped to us or a "dd"
image (through Unix) on DVD or CD.

For simple jobs, we'll usually send you your data on CD or DVD usually
within 48 hours! We charge by the hour, but with every job you get a
full up-front estimate BEFORE we begin any work. You get a complete
forensic report (if required), and your data recovered on CD or DVD.

If you would like more information, you can visit my company's website
at http://www.armordata.com and you can even fill out a free online
request for quotation. We're a small but reputable company and we
pride ourselves (above all else) on customer satisfaction, more so
than making a quick buck.

(Ken1) wrote in message news:<>...
> I have a HD with a single NTFS partion which have lost the
> partition table info because of corrupt sectors/blocks.
>
> I have tried DIY DataRecovery iRecover and OnTrack EasyRecovery
> to copy/recover the data to a new disk. With DIY DataRecovery
> I can scan the disk to find the NTFS partion and start the
> recovery but the progress bar stays on 0% all the time.
> The program also says Filesystem type is: Not known so far
> during that time, even it it earlier found the partion info
> when scanning.
>
> When using OnTrack EasyRecovery the program starts and displaying
> the filenames/directory it finds and increases the block
> count but after a couple of minutes it stops at the same block number
> every time I run it (#3840) and the disk sound stops which was
> was heard up till this block number. And it does not continue to
> even if I wait a very long time.
>
> Is there any possibly to copy the information over to a new
> hard drive in any way, which ignore corrupt block, so I can
> revover most of the files?
>
> /Kenneth

John Bradley wrote:
>
> Don't you worry, help is more affordable than you think! Especially
> when you consider what your time is worth to you, and how much importance
> you place on your valuable data.
>
> My company specializes in computer forensic data recovery services and
> data recovery software development. We develop and employ the latest
> data recovery software on the market so we can often recover deleted
> files pretty quickly! We serve individuals, small businesses, and
> corporations worldwide.
>
> We can:
> - recover lost files
> - recover deleted files
> - recover deleted e-mail messages
> - rebuild and recover entire physical disk partitions
> - recover raid data
> - recover pictures
> - discover evidence related to investigations (e.g., Internet
> activity)
>
> In your case, it is very likely that we could recover most, if not
> all, of your data. Because you know the name of the folder or files that
> were deleted, it would be pretty quick for us to do. We can also search
> for specific filenames you need recovered and even recover partially
> overwritten data (e.g., an important MS Word document).
>
> Once you delete your data and empty the recycle bin, your data ends up
> in unallocated space. So essentially, you can try using third party
> freeby software and cross your fingers, or you can leave it up to the
> experts.
>
> By the way, we serve both individuals and corporations. Our rates are
> very reasonable and you only pay if we recover your data. No data, no
> charge. What we would need is your hard drive shipped to us or a "dd"
> image (through Unix) on DVD or CD.
>
> For simple jobs, we'll usually send you your data on CD or DVD usually
> within 48 hours! We charge by the hour, but with every job you get a
> full up-front estimate BEFORE we begin any work. You get a complete
> forensic report (if required), and your data recovered on CD or DVD.
>
> If you would like more information, you can visit my company's website
> at http://www.armordata.com and you can even fill out a free online
> request for quotation. We're a small but reputable company and we
> pride ourselves (above all else) on customer satisfaction, more so
> than making a quick buck.
>
> Regards,
>
> John Bradley
> Armor Data Inc.
> "Specialists in computer forensic data recovery services"
> "The quality is in our name"
>
> (Ken1) wrote in message news:<>...
> > I have a HD with a single NTFS partion which have lost the
> > partition table info because of corrupt sectors/blocks.
> >
> > I have tried DIY DataRecovery iRecover and OnTrack EasyRecovery
> > to copy/recover the data to a new disk. With DIY DataRecovery
> > I can scan the disk to find the NTFS partion and start the
> > recovery but the progress bar stays on 0% all the time.
> > The program also says Filesystem type is: Not known so far
> > during that time, even it it earlier found the partion info
> > when scanning.
> >
> > When using OnTrack EasyRecovery the program starts and displaying
> > the filenames/directory it finds and increases the block
> > count but after a couple of minutes it stops at the same block number
> > every time I run it (#3840) and the disk sound stops which was
> > was heard up till this block number. And it does not continue to
> > even if I wait a very long time.
> >
> > Is there any possibly to copy the information over to a new
> > hard drive in any way, which ignore corrupt block, so I can
> > revover most of the files?
> >
> > /Kenneth

I wouldn't trust someone's software much when that person can't even setup
his newsclient correctly to make a proper post.

"Jan van Wijk" <> wrote in message news:W1d6fUB5m4qH-pn2-vbZOGpeKoqHi@merlin
> On Sat, 21 Feb 2004 23:06:03 UTC, (Ken1) wrote:
>
> > I have a HD with a single NTFS partion which have lost the
> > partition table info because of corrupt sectors/blocks.
>

[snip]
>
> Note the description of the "-b:1" parameter, which will make the
> CLONE
> quite slow (many hours) but will result in the minimum number of
> sectors
> being skipped as bad-sectors.
>

"Ken1" <> wrote in message news:
> I have a HD with a single NTFS partion which have lost the
> partition table info because of corrupt sectors/blocks.
>
> I have tried DIY DataRecovery iRecover and OnTrack EasyRecovery
> to copy/recover the data to a new disk. With DIY DataRecovery
> I can scan the disk to find the NTFS partion and start the
> recovery but the progress bar stays on 0% all the time.
> The program also says Filesystem type is: Not known so far during
> that time, even it it earlier found the partion info when scanning.

There is a utility on Svend's website that can overwrite the bad sectors.
You may then be able to use the utilities to copy the data, including Svends.
>
> When using OnTrack EasyRecovery the program starts and display-
> ing the filenames/directory it finds and increases the block count
> but after a couple of minutes it stops at the same block number
> every time I run it (#3840) and the disk sound stops which was
> was heard up till this block number. And it does not continue to
> even if I wait a very long time.
>
> Is there any possibly to copy the information over to a new
> hard drive in any way, which ignore corrupt block, so I can
> revover most of the files?

"Ken1" <> wrote in message
news:
> With DIY DataRecovery
> I can scan the disk to find the NTFS partion and start the
> recovery but the progress bar stays on 0% all the time.
> The program also says Filesystem type is: Not known so far during
> that time, even it it earlier found the partion info when scanning.

iRecover doesn't rely on the file system type that was recorded in the
partition table, after all it may concern a FAT32 partition that was
accidentally formatted NTFS.

"Joep" <j o e p @ d i y d a t a r e c o v e r y . n l> wrote in message news:a1d25$40578d76$3eddca68$-service-com
> "Ken1" <> wrote in message news:
> > With DIY DataRecovery
> > I can scan the disk to find the NTFS partition and start the
> > recovery but the progress bar stays on 0% all the time.
>
> > The program also says Filesystem type is: Not known so far during
> > that time, even it it earlier found the partition info when scanning.
>
> iRecover doesn't rely on the file system type that was recorded in the
> partition table, after all it may concern a FAT32 partition that was
> accidentally formatted NTFS.

That still doesn't explain the conflicting info.
It would then be a NTFS partition and not a Fat32 partition.
>
> Joep

In the partition table it would say NTFS, however the file system you want
to recover from would be FAT32. As iRecover scan the partition it will find
more and more evidence that the data actually present corresponds with a FAT
type partition (assuming the partition was formatted in error and no data
was written to it yet).

As long as iRecover hasn't decided on the file system yet, it will say the
file system is unknown EVEN when it says NTFS in the partition table. For
this part of the analysis it's irrelevant what the file system is as
iRecover will collect all possible components regardless if they're FAT or
NTFS type components.

Then when it has decided on the file system, and for arguments sake, this is
FAT32, it will say so, again EVEN when the partition table says NTFS.

If the situation is too conflicting the user can specify in advance that the
file system is FAT/NTFS. This may be required for example if data was
written to the partition formatted in error, or when a tool like
PartitionMagic is frequently used to move and convert partitions (PM doesn't
"clean up" when for example moving a partition). But even then, during the
collection phase the file system is 'unknown'. In the end, although the user
selected FAT, there may not be enough data found to allow recovery from the
F.U.B.A.R. FAT partition

"Folkert Rienstra" <> wrote in message
news:c3ac15$25sgf2$-berlin.de...
> "Joep" <j o e p @ d i y d a t a r e c o v e r y . n l> wrote in message
news:a1d25$40578d76$3eddca68$-service-com
> > "Ken1" <> wrote in message
news:
> > > With DIY DataRecovery
> > > I can scan the disk to find the NTFS partition and start the
> > > recovery but the progress bar stays on 0% all the time.
> >
> > > The program also says Filesystem type is: Not known so far during
> > > that time, even it it earlier found the partition info when scanning.
> >
> > iRecover doesn't rely on the file system type that was recorded in the
> > partition table, after all it may concern a FAT32 partition that was
> > accidentally formatted NTFS.
>
> That still doesn't explain the conflicting info.
> It would then be a NTFS partition and not a Fat32 partition.
>
> >
> > Joep

So how does the FATxx designation get itself in the partition table,
if not by the formatting operation?

"Joep" <> wrote in message news:-holland.nl
> It's not conflicting info, it's a conflicting situation:
>
> In the partition table it would say NTFS, however the file system you want
> to recover from would be FAT32. As iRecover scan the partition it will find
> more and more evidence that the data actually present corresponds with a FAT
> type partition (assuming the partition was formatted in error and no data
> was written to it yet).
>
> As long as iRecover hasn't decided on the file system yet, it will say the
> file system is unknown EVEN when it says NTFS in the partition table.
> For this part of the analysis it's irrelevant what the file system is as
> iRecover will collect all possible components regardless if they're FAT or
> NTFS type components.
>
> Then when it has decided on the file system, and for arguments sake, this is
> FAT32, it will say so, again EVEN when the partition table says NTFS.
>
> If the situation is too conflicting the user can specify in advance that the
> file system is FAT/NTFS. This may be required for example if data was
> written to the partition formatted in error, or when a tool like
> PartitionMagic is frequently used to move and convert partitions (PM doesn't
> "clean up" when for example moving a partition). But even then, during the
> collection phase the file system is 'unknown'. In the end, although the user
> selected FAT, there may not be enough data found to allow recovery from the
> F.U.B.A.R. FAT partition
>
> Joep
>
>
> "Folkert Rienstra" <> wrote in message
> news:c3ac15$25sgf2$-berlin.de...
> > "Joep" <j o e p @ d i y d a t a r e c o v e r y . n l> wrote in message
> news:a1d25$40578d76$3eddca68$-service-com
> > > "Ken1" <> wrote in message
> news:
> > > > With DIY DataRecovery
> > > > I can scan the disk to find the NTFS partition and start the
> > > > recovery but the progress bar stays on 0% all the time.
> > >
> > > > The program also says Filesystem type is: Not known so far during
> > > > that time, even it it earlier found the partition info when scanning.
> > >
> > > iRecover doesn't rely on the file system type that was recorded in the
> > > partition table, after all it may concern a FAT32 partition that was
> > > accidentally formatted NTFS.
> >
> > That still doesn't explain the conflicting info.
> > It would then be a NTFS partition and not a Fat32 partition.
> >
> > >
> > > Joep

In article <c3tb0b$20ar2t$-berlin.de>,
Folkert Rienstra <> top-posted (grr):
>"Joep" <> top-posted (grr) in message
>news:-holland.nl
>> In the partition table it would say NTFS, however the file system you want
>> to recover from would be FAT32. As iRecover scan the partition it will find
>> more and more evidence that the data actually present corresponds with a FAT
>> type partition (assuming the partition was formatted in error and no data
>> was written to it yet).
>
>So how does the FATxx designation get itself in the partition table,
>if not by the formatting operation?

Info on what type of filesystem is (supposedly) in a given partition is
stored in the partition table. Some partitioning tools (such as Linux's
fdisk) let you change this information without resizing partitions or
writing new filesystems to those partitions. You could start from a Linux
boot floppy or CD, change the ID for a partition from FAT32 to NTFS (or any
of the 92 partition types fdisk knows about), and end up with a situation
where the type of filesystem in a partition doesn't match what the partition
table says it should have.

Partitioning and formatting are separate operations, even under DOS, so it
would be unwise to blindly assume that what the partition table says is
correct.

And in actual fact.
> HOWEVER the file system more interesting for analysis is FAT32;
> iRecover should treat this as a FAT32 drive rather than an NTFS one.

But since it now is a valid NTFS partition it should at least mention that.
>
> The conflicting info is, that while the partition table says NTFS, we're not
> interested in NTFS data structures, we're interested IN FAT data structures.

Apparently that was not clear to OP. Perhaps that should be made clearer.
>
> --
> Joep

Which I consider a minute offense compared to posting
someone's <reply address> instead of the <sender address>.

(huge grr)
> > "Joep" <j o e p @ d i y d a t a r e c o v e r y . n l> top-posted (grr) in message news:-holland.nl
> >
> > > In the partition table it would say NTFS, however the file system you want
> > > to recover from would be FAT32. As iRecover scan the partition it will find
> > > more and more evidence that the data actually present corresponds with a FAT
> > > type partition (assuming the partition was formatted in error and no data
> > > was written to it yet).
> >
> > So how does the FATxx designation get itself in the partition table,
> > if not by the formatting operation?

I retract the question because -after reread- it didn't make any sense.
Apparently I misinterpreted Joep's answer.

Share This Page

Welcome to PC Review!

Hello and welcome to PC Review. We're a friendly computing community, bustling with knowledgeable members to help solve your tech questions.

Please join our friendly community by clicking the button below - it only takes a few seconds and is totally free. You'll be able to ask any tech support questions, or chat with the community and help others.
Sign up now!